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Abstract. We analyse the number of occurrences of a fixed non-zero digit in 
the width-ui non-adjacent forms of all elements of a lattice in some region (e.g. a 

^v^J ball). Our result is an asymptotic formula, where its main term coincides with 

the full block length analysis. In its second order term a periodic fluctuation 
is exhibited. The proof follows Delange's method. This result in a general 

^s^j lattice set-up is then used for numeral systems with an algebraic integer as 

base. Those come from efficient scalar multiplication methods (Frobenius-and- 
add methods) in hyperelliptic curves cryptography, and our result is needed 
U for analysing the running time of such algorithms. 



1. Introduction 

One main operation in hyperelliptic curve cryptography is building (large) multi- 
pies of an element of the Jacobian variety of a hyperelliptic curve over a finite field. 
Clearly, we want to perform that scalar multiplication as efficiently as possible. A 
standard method there are double-and-add algorithms, where the multiple to build 

!— 1 is written in binary, and then a Horner scheme is performed. By using windowing 

methods that algorithms can be sped up. The idea is to take a larger digit set 
and choose an expansion which has a low number of non-zero digits. This leads 

00 t° an efficient evaluation. Some background information on hyperelliptic curve 

i-H cryptography can be found for example in pQ. 

If the hyperelliptic curve is defined over a finite field with q elements and we 
are working over an extension (over a field with q m elements), then one can use a 

ON Frobenius-and-add method instead. There the (expensive) doublings are replaced 

by the (cheap) evaluation of the Frobenius endomorphism on the Jacobian variety: 
If 

. . L-1 

> * = E^ 

X 

with digits ^ and where the base r is a zero of the characteristic polynomial of the 
Frobenius endomorphism on the Jacobian, then for an element Q of the Jacobian 
we can compute zQ by 

L-1 
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where <p denotes the Frobenius endomorphism. That base r is an algebraic integer 
whose conjugates all have the same absolute value, cf. Deligne [7j, Dwork |8j and 



Weil [OH HOI HI] ; and see Section 11 for more details. 

So let us consider digital expansions with a base as above. Let w be a positive 
integer. Our digit set should consist of and one representative of every residue 
class modulo t w which is not divisible by r. That choice of the digit set yields 
redundancy, i.e., each element of TL\t\ has more than one representation. The 
width- w non- adjacent form, iu-NAF for short, is a special representation: Every 
block of w consecutive digits contains at most one non-zero digit. The choice of the 
digit set guarantees that the w-NAF-expansion is unique. The low weight (number 
of non-zero digits) of that expansion makes the arithmetic on the hyperelliptic 
curves efficient. 

In the case that the base r is an imaginary-quadratic algebraic integer properties 
of such w-NAF numeral systems are known: The question whether for a given 
digit set each element of E[r] has a representation as a w-NAF is investigated 
in Koblitz [16], Solinas Q71 HE], Blake, Murty and Xu [1 U, and Heuberger 
and Krenn \V2\ . Another question, namely whether the w-NAF is an expansion 
which minimises the weight among all possible expansions with the same digit 
set, is answered in Heuberger and Krenn [13J . A generalisation of those existence 
and optimality results to higher degree of the base r is given in Heuberger and 
Krenn [14] . One main step there was to use Minkowski map to transform the 



r-adic setting to a lattice, see also Section 11 

The present work deals with analysing the number of occurrences of a digit in 
w-NAF-expansions with base r (an algebraic integer of degree n). This is needed for 
the analysis of the running time of the scalar multiplication algorithm mentioned 
at the beginning of this introduction. As brought up in the previous paragraph, 



we will do this analysis in the set-up of numeral systems in lattices, cf. Section 11 
Our main result is the asymptotic formula 

Z n = N n E log N + N n r/,„ (log A) + O^N 13 log N) . 

for the number of occurrences of a fixed non-zero digit rj in w-NAF-expansions in a 
ball around with radius N. The main term of that formula coincides with the full 
block length analysis given in Heuberger and Krenn [12] . There an explicit expres- 
sion for the expectation (the constant E) and the variance of the occurrence of such 
a digit in all expansions of a fixed length is given. The result here is more precise: 
A periodic fluctuation ^ in the second order term is also exhibited. The third 
term is an error term with f3 < n. Such structures — main term, oscillation term, 
smaller error term — are not uncommon in the context of digits counting, see for 
instance, Heuberger and Prodinger |15j or Grabner, Heuberger and Prodinger [10] - 
The result itself is a generalisation of the one found in Heuberger and Krenn [T3] . 
The proof, as the one in [12 , follows Delange's method, cf. Delange [5J, but several 
technical problems have to be taken into account. 

The structure of this article is as follows. We start with the formal definition of 
numeral systems and the non-adjacent form in Section [2] Sections [3] and [4] contain 
our primary set-up in a lattice. We will work in this set-up throughout the entire 
article. There also the used digit set, which comes from a tiling by the lattice, 
is defined. Additionally, some notations are fixed and some basic properties are 
given. The end of Section [3] is devoted to the full block length analysis theorem 
given in Heuberger and Krenn [T3] . In Sections [5] to [9] a lot of properties of the 
investigated expansions, such as bounds of the value and the behaviour of the 
fundamental domain and the characteristic sets, are derived. Those arc needed to 



prove our main result, the counting theorem in Section 10 The last section will 
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forge a bridge to the r-adic set-up. This is explained with details there and the 
counting theorem is restated in that set-up. 

A last remark on the proofs given in this article. As this work is a generalisa- 
tion of Heuberger and Krenn |12j several proofs of propositions and lemmata are 
skipped. All those are straight forward generalisations of the ones for the quadratic 
case, which means, we have to do things like replacing Z[r] by the lattice, the mul- 
tiplication by r by a lattice endomorphism, the dimension 2 by n, using a norm 
instead of the absolute value, and so on. If the generalisation is not that obvious, 
the proofs are given. 

2. Non-Adjacent Forms 

This section is devoted to the formal introduction of width-w non-adjacent forms. 
Let A be an Abelian group, $ an injective endomorphism of A and w a positive 
integer. Later, starting with the next section, the group A will be a lattice with the 
usual addition of lattice points. 

We start with the definition of the digit set used throughout this article. 

Definition 2.1 (Reduced Residue Digit Set). Let PC A. The set V is called a re- 
duced residue digit set modulo <$> w , if it is consists of and exactly one representative 
for each residue class of A modulo $ W A that is not contained in <f>A. 

Next we define the syntactic condition of our expansions. This syntax is used to 
get unique expansions, because our numeral systems are redundant. 

Definition 2.2 (Width-w Non- Adjacent Forms). Let r] = (%) - ez € £> Z ■ The 

sequence rj is called a width-w non-adjacent form, or w-NAF for short, if each 
factor rij-\- w -\ . . . rjj, i.e., each block of width w, contains at most one non-zero 
digit. 

Let J := {j eWj : rjj ^ 0}. We call sup({0} U ( J + 1)) the left-length of the 
w-NAF r] and -inf({0} U J) the right-length of the w-NAF rj. Let £ and r be 
elements of No U {fin, oo}, where fin means finite. We denote the set of all w-NAFs 
of left-length at most I and right-length at most r by NAF^ 1 *. The elements of 
the set NAFJ,"' will be called integer w-NAFs. The most-significant digit of a 
7] € NAFj' 00 is the digit rjj ^ 0, where j is chosen maximally with that property. 

For 77 <= NAF^ n -°° we call 

value(»7) := &Vj 

the value of the w-NAF rj. 

The following notations and conventions are used. A block of digits zero is 
denoted by 0. For a digit ij and k € N we will use 

v k '■= v_^_n> 

k 

with the convention 77 := e, where e denotes the empty word. A tu-NAF rj = 
(f}j)j eZ will be written as r)i.r)F, where r\i contains the rjj with j > and r\F 
contains the r\j with j < 0. r\i is called integer part, rjp fractional part, and the 
dot is called $ -point. Left- leading zeros in rji can be skipped, except t]q, and right- 
leading zeros in r)p can be skipped as well. If rjp is a sequence containing only 
zeros, the $-point and this sequence is not drawn. 

Further, for a w-NAF T] (a bold, usually small Greek letter) we will always use 
rjj (the same letter, but indexed and not bold) for the elements of the sequence. 
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The set NAF^ n '°° can be equipped with a metric. It is defined in the following 



way. Let p > 1. For rj £ NAF^°° and £ G NAF^°° define 



dNAF(»7,€) := 



{j&Z'Vj&j} ifr/^£, 
if »7 = £• 



So the largest index, where the two w-NAFs differ, decides their distance. See for 
example Edgar [5] for details on such metrics. 

We get a compactness result on the metric space NAF^°° C NAF*"' 00 , I £ N , 
see the proposition below. The metric space NAF*"' 00 is not compact, because if we 
fix a non-zero digit i], then the sequence (^CP) . N has no convergent subsequence, 



but all nO j are in the set NAF^, n ' c 



Proposition 2.3. For every I > the metric space ^NAF^°°, d[\iAF^ is compact. 
This is a consequence of Tychonoff 's Theorem, see [T2] for details. 



3. The Set-Up and Notations 

In this section we describe the set-up, which we use throughout this article. 

(1) Let A be a lattice in R n with full rank, i.e., A = w-yE®- ■ ■®w n 'Z for linearly 
independent w\, . . . , w n £ R n . 

(2) Let n € N and $ be an endomorphism of R n with $(A) C A. We assume 
that each eigenvalue of $ has the same absolute value p, where p is a fixed 
real constant with p > 1. Further we assume that p" e N. Additionally, 
we take this p as parameter in the definition of the metric cInaf- 

(3) Suppose that the set T C R™ tiles the space R" by the lattice A, i.e., the 
following two properties hold: 

( a ) UeA^ + ^R", 

(b) T n (z + T) C dT holds for all z £ A with z^O. 

Further, we assume that T is closed and that X(dT) — 0, where A denotes 
the n-dimensional Lebesgue measure. We set d\ := A(T). 

(4) Let || • || be a vector norm on R" such that for the corresponding induced 
operator norm, also denoted by || • ||, the equalities ||$|| = p and H^" 1 )! = 
p^ 1 hold. 

For a z £ A and non-negative r £ R the open ball with centre z and 
radius r is denoted by 

B(z,r) := {y £ A : < r} 

and the closed ball with centre z and radius r by 

B(z,r) := {y £ A : \\z - y\ < r} . 

(5) Let r and R be positive reals with 

B(0,r) CT CB(0,R) . (3.1) 

(6) Let w be a positive integer such that 

- < p w - 1. (3.2) 
r 

(7) Let I? be a reduced residue digit set modulo 3> t0 , cf. Definition |2.1| corre- 
sponding to the tiling T, i.e. the digit set V fulfils V C $ W T. 

Further, suppose that the cardinality of the digit set V is 

p n{w-l) (p « + 
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We use the following notation concerning our tiling: for a lattice element z G A 
we set T z := z + T. Therefore \JzeA T z = R ™ and ^nT 2 C dT z for all distinct 
y,zeA. 

Next we define a fractional part function in R" with respect to the lattice A, 
which should be a generalisation of the usual fractional part of elements in R with 
respect to the rational integers 7L. Our tiling T induces such a fractional part. 

Definition 3.1 (Fractional Part). Let T be a tiling arising from T in the following 
way: Restrict the set f C T such that it fulfils l+J^ eA (z + f)= R". 

For z € R™ with z = u + v, where u G A and v € T define the fractional part 
corresponding to the lattice A by {z} A := U. 

Note that this fractional part depends on the tiling T (or more precisely, on the 
tiling T). We omit this dependency, since we assume that our tiling is fixed. 

4. Some Basic Properties and some Remarks 

The previous section contained our set-up. Some basic implications of that set- 
up are now given in this section. Further we give remarks on the tilings and on the 
digit sets used, and there are also comments on the existence of w-NAF-expansions 
in the lattice. 

We start with two remarks on our mapping $. 

Remark 4.1. Since all eigenvalues of <£> have an absolute value larger than 1, the 
function $ is injective. 

Remark 4.2. We have assumed ||<I>|| = p and = p~ x ■ Therefore, for all J € 7L 

the equality ||^ >J || = p J follows. 

Remark 4.3. The endomorphism <E> is diagonalisable. This follows from the as- 
sumptions that all eigenvalues have the same absolute value p and the existence of 
a norm with ||$|| = p. 

One special tiling comes from the Voronoi diagram of the lattice. This is stated 
in the remark below. 

Remark 4.4. Let 

V := {z e R" : Vy E A : \\z\\ < \\z - y\\} . 

We call V the Voronoi cell for corresponding to the lattice A. Let u € A. We 
define the Voronoi cell for u as V u := u + V. 

Now choosing T = V results in a tiling of the R" by the lattice A. 

In our set-up the digit set corresponds to the tiling. In Remark |4.5| this is 
explained in more details. The Voronoi tiling mentioned above gives rise to a special 
digit set, namely the minimal norm digit set. There, for each digit a representative 
of minimal norm is chosen. 

Remark 4.5. The condition — < p w — 1 in the our set-up implies the existence of 
w-NAFs: each element of A has a unique w-NAF-expansion with the digit set V. 
See Heuberger and Krenn [14] for details. There numeral systems in lattices with 
w-NAF-condition and digit sets coming from tilings are explained in detail. Further 
it is shown that each tiling and positive integer w give rise to a digit set T>. 
Because T> C $»T, we have 

P w r < \\d\\ < p w R 

for each non-zero digit d G T>. 

Further, we get the following continuity result. 
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Proposition 4.6. The value function value is Lipschitz continuous on NAF*"' 00 . 

This result is a consequence of the boundedness of the digit set, see [12] for a 
formal proof. 

We need the full block length distribution theorem from Heuberger and Krenn [T^] . 
This was proved for numeral systems with algebraic integer r as base. But the result 
does not depend on r directly, only on the size of the digit set, which is dependent 
on the norm of r. In our case this norm equals p n . That replacement is already 
done in the theorem written down below. 

Theorem 4.7 (Full Block Length Distribution Theorem). Denote the number of 
w-NAFs of length m G N by C m . We get 

C m = , „ * - P n[m+W) + 0((w n ) m ) , 
[p n — l)w + 1 

where p = {1 + -^ y 1 < 1. 

Further let ^ r\ G T> be a fixed digit and define the random variable X m „ to 
be the number of occurrences of the digit r\ in a random w-NAF of length m, where 
every w-NAF of length m is assumed to be equally likely. Then we get 

E(I m! ,) = £m + 0(l) 

for the expectation, where 

E = 



The theorem in |12j gives more details, which we do not need for the results in 
this article: We have 

E(X m)77 ) = Em + Eq + 0{mp m ) 
with an explicit constant term Eq. Further the variance 

V^,,) =Vm + V + 0(m 2 p m ) 
with explicit constants V and Vq is calculated, and a central limit theorem is proved. 

5. Bounds for the Value of Non-Adjacent Forms 

In this section we have a closer look at the value of a w-NAF. We want to find 
upper bounds, as well as, a lower bound for it. In the proofs of all those bounds we 
use bounds for the norm || • || . More precisely, geometric parameters of the tiling T, 
i.e., the already defined reals r and R, are used. 

The following proposition deals with three upper bounds, one for the norm of 
the value of a w-NAF-expansion and two give us bounds in conjunction with the 
tiling. 

Proposition 5.1 (Upper Bounds). Let r) e NAF^ n, °°, and denote the position of 
the most significant digit of 77 by J. Let 

u 1 - p- w 
Then the following statements are true: 

(a) We get 

||value(fj)|| < p J B v 

(b) We have 

valued) G |J B(z, p~ w+J ' B v ) . 
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(c) We get 

value(j7) G <5> 2w + J T. 

(d) For each £ G No we have 

value(0.?7_i . . . rj-e) + <f>~ l T C $ 2w " 1 T. 

Note that p J = cImaf(*7 i 0), so we can rewrite the statements of the proposition 
above in terms of that metric, see also Corollary |5.3| 



Proof, (a) In the calculations below, we use the Iversonian notation [expr] = 1 if 
expr is true and [expr] = otherwise, cf. Graham, Knuth and Patashnik 

The result follows trivially for r/ = 0. First assume that the most significant 
digit of r\ is at position 0. Since \\r)-j\\ < p w R, see Remark 4.5 on page 5 p > 1 
and r] is fulfilling the «7-NAF-condition we obtain 



|value(f7)|| = 



3=0 



< 



Ell*"f ii^ii = E 



p-'h-i\ 



3=0 



3=0 



< p w rY j p~ 3 b-i ¥> o] < P w Rj2p~ j H = ( mod w )l 

3=0 3=0 

p w R 



p w R^2p 



iv k 



k=0 



In the general case we have the most significant digit of 77 at a position J. 
Then value(r/) = $ J valuef^') for a w-NAF 77' with most significant digit at 
position 0. Therefore 

||value(r/)|| = ||$' 7 value(r?')|| < ||$|| J 1 1 va lue(rj') 1 1 <p J B v , 

which was to prove. 

(b) There is nothing to show if the u>-NAF 77 is zero. First suppose that the most 
significant digit is at position w. Then, using Q, we have 

HvaluefaJ-^JtoH <Bu, 

therefore 

valuefa) B v ) . 

Since t] w G & w T, the statement follows for the special case. The general case 
is again obtained by shifting. 

(c) Using the upper bound found in ([a]) and the assumption (3.2 1 yields 



o w R 

|value(»|)|| < p J B v = p J - _ — < r P 



2w+J 



Since B(0, rp 2w+J ) C $ 2 ™+ J T, the statement follows, 
(d) Analogously to the proof of ([a]), except that we use £ for the upper bound of 
the sum, we obtain for v G T 



|value(0.?7_i . . . rj-t) + $ e v || < ||value(0.ry_i . . . 17 ^ ) 1 1 + p R 

< P - 1 pWR (i-p-H^J 
- p 1 - p-«> V p 

«tU — 1 D 

< P- (1 - p- l+1 - w + p- e - 

P R r, 
= (1 — p 

1 - P - W v p 



u (l-p-™)) 



-l-2uA 
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Since 1 - p 1+1 2w < 1 we get 

o w R 

|| value(0.»7_i . . . rj-e) + * _< r|| < p~ l 1 " — = p^Bu 

for all I € No. By the same argumentation as in the proof of the statement 
follows. □ 

Next we want to find a lower bound for the value of a w-NAF. Clearly the 
w-NAF has value 0, so we are interested in cases where we have a non-zero digit 
somewhere. 

Proposition 5.2 (Lower Bound). Let rj £ NAF* n,cc be non-zero, and denote the 
position of the most significant digit of rj by J. Then we have 

||value(77)|| > p J B L , 

where 

B L =r- p- 2w B v = r 



p w - 1 



Note that Bl > is equivalent to ^ < p w — 1, i.e. the assumption (3.2). More- 
over, we have 

r-B L F 

Proof of Proposition \5l^ First suppose the most significant digit of the w-NAF r/ 
is at position and the second non-zero digit (read from left to right) at position J. 
Then 

OO 

valued) -no = G |J B(z,p- w+J Bu) C |J B(z,p- 2w Bu) 

k=w zeT z€T 

according to ([b]) of Proposition 5.1 on page 6[ Therefore 

valuefa) e |J B(z,p- 2w Bu). 



This means that value(r/) is in T Vo or in a p~ 2w By-strip around this cell. The two 
tiling cells T Vo for r/o and Tq = T for are disjoint, except for parts of the boundary, 
if they are adjacent. Since a ball with radius r is contained in each tiling cell, we 
deduce that 

||value(t|)|| > r - p~ 2w B v = r - = B L , 

which was to show. The case of a general J is again, as in the proof of Proposition |5.1| 
obtained by shifting. □ 

Combining the previous two propositions leads to the following corollary, which 
gives an upper and a lower bound for the norm of the value of a iw-NAF by looking 
at the largest non-zero index. 

Corollary 5.3 (Bounds for the Value). Let r\ E NAF*'°°, then we get 

d NAF ( V ,0)B L < ||va[ue(T?)|| < d NAF (j7, 0) B v . 

Proof. Follows directly from Proposition |5.1 on page 6| and Proposition \5.2\ since 
the term p J is equal to dfj/^p (77 ; 0). □ 

Last in this section, we want to find out if there are special w-NAFs for which 
we know for sure that all their expansions start with a certain finite w-NAF. This 
is formulated in the following lemma. 
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Lemma 5.4. There is a kg € No such that for all k > kg the following holds: If 
r\ G NAF^ -00 starts with the word k , i.e., r\^\ = 0, . . . , r\-k = 0, then we get for 
all £ G NAF^-°° that value(£) = value(rj) implies £ G NAF°'°°. 



Proof. Let | = £/.£_f. Then ||value(£/.£i?)| < Bl implies = 0, cf. Corollary 5.3 
Further, for our rj we obtain z = ||value(Tj)|| < p~ k Bjj. So it is sufficient to show 
that 

p- k B v < B L , 

which is equivalent to 
We obtain 



k > 2w - log p ( - (p w - 1) - 1 



\R 

where we just inserted the formulas for Bu and B^. Choosing an appropriate fco is 
now easily possible. □ 



Note that the we can find a constant k\ independent from w such that for all 
k > 2w + ki the assertion of Lemma 5.4 holds. This can be seen in the proof, since 
(p w — 1) — 1 is monotonically increasing in w. 

6. Right-infinite Expansions 

We have the existence of a (finite integer) iu-NAF-expansion for each element of 
the lattice A C R™, cf. Remark |4.5| But that existence condition is also sufficient 
to get w-NAF-expansions for all elements in E". Those expansions possibly have 
an infinite right-length. The aim of this section is to show that result. The proofs 
themselves are a minor generalisation of the ones given in [T2] for the quadratic 
case. 

We will use the following abbreviation in this section. We define 

[*- x ]A:= |J $- j A. 

Note that A C ^A. 

To prove the existence theorem of this section, we need the following three lem- 
mata. 

Lemma 6.1. The function value| NAF fin.fin is infective. 

Proof. Let rj and £ be elements of NAF f ^ n ' fm with value(?7) = value(^). This implies 
that $> J va\ue(r)) = <f> J value(^) G A for some JeS. By uniqueness of the integer 
w-NAFs we conclude that r\ — £. □ 

Lemma 6.2. We have value(NAF*"- fin ) = [$- x ]A. 

Proof. Let r) G NAF^, n ' fm . There are only finitely many r/j ^ 0, so there is a J G No 
such that value(rj) G $~' 7 A. Conversely, if z G <I>~ J A, then there is an integer 
w-NAF of Q J z, and therefore, there is a £ G NAF^ n - fin with value(£) — z. □ 

Lemma 6.3. [$ _1 ]A is dense in R". 

Proof. Let A = w-JL © • • • © w n 7L for linearly independent w\, . . . ,w n G R™. Let 
z G R" and K G N . Then <& K z = Z\W\ + • • • + z n w n for some reals z\, . . . , z n . We 
have 

\\z- (lz 1 \<S>- K w 1 + ---+lz n \ *-*"«;«) || <p~ K (IKH+--- + IKH), 
which proves the lemma. □ 
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Now we can prove the following theorem. 

Theorem 6.4 (Existence Theorem concerning R n ). Let z £ R". Then there is 
an r\ 6 NAF^ n '°° such that z = valued), i.e., each element in R™ has a w-NAF- 
expansion. 



Proof. By Lemma 6.3 on the preceding page there is a sequence z n € [_> ]A 



converging to z. By Lemma 6.2 on the previous page} there is a se quence rj n £ 



NAF fm.fin with 

value(»7 n ) = z n for all n. By Corollary |5. 3 on page 8| the sequence 
dNAF(»7n,0) is bounded fro m above, so th ere is an I such that J7„ e NAF^ fin C 



NAF^ 00 . By Proposition 2.3 on page 4 we conclude that there is a convergent 



subsequence v( n of r;„. Set r/ := lim.n_j.oo Vn- By continuity of value, see Proposi- 



tion 4.6 on page 6 we conclude that value(?7) = z. □ 



7. The Fundamental Domain 

We now derive properties of the Fundamental Domain, i.e., the subset of R" 
representable by w-NAFs which vanish left of the <_-point. The boundary of the 
fundamental domain is shown to correspond to elements which admit more than 
one ui-NAFs differing left of the <_-point. Finally, an upper bound for the Hausdorff 
dimension of the boundary is derived. 

All the results in this section are generalisations of the propositions and remarks 
found in [12j . For some of those results given here, the proof is a the same as in the 
quadratic case or a straight forward generalisation of it. In those cases the proofs 
will be skipped. 

We start with the formal definition of the fundamental domain. 
Definition 7.1 (Fundamental Domain). The set 

T := value(NAF°-°°) = {value(£) : £ € NAF"'°° } . 
is called fundamental domain. 



The pictures in Figure 9.1 on page 16 show some fundamental domains for lattices 
coming from imaginary-quadratic algebraic integers r. We continue with some 
properties of fundamental domains. We have the following compactness result. 

Proposition 7.2. The fundamental domain J- is compact. 

Proof. The proof is a straight forward generalisation of the proof of the quadratic 
case in [12]. □ 

We can also compute the Lebesgue measure of the fundamental domain. This 



result can be found in Remark 9.3 on page 17 To calculate A (J 7 ), we will need the 
results of Sections [8] and [9] 

The space R™ has a tiling property with respect to the fundamental domain. 
This fact is stated in the following proposition. 

Proposition 7.3 (Tiling Property). The space R™ can be tiled with scaled versions 
of the fundamental domain J- . Only finitely many different size are needed. More 
precisely: Let K € TL. then 

R" = |J ($ fe valued) + <t> k -' w+1 T) , 

ke{K,K+l,...,K+w-l} 
£6NAF f ^'° 

k =fc K 4- w — 1 implies £o 7^ 

and the intersection of two different <_ fe value(£) + & k ~ w+1 J r in this union is a subset 
of the intersection of their boundaries. 
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Proof. The proof is a straight forward generalisation of the proof of the quadratic 
case in [12]. □ 

Note that the intersection of the two different sets of the tiling in the previous 
corollary has Lebesgue measure 0. This will be a consequence of Proposition |7.6| 



Remark 7.4 (Iterated Function System). Define fo(z) = $ _1 z and for a non-zero 
digit <d G V define fa(z) = <j> _1 t9 + $~ w z. Then the (affine) iterated function 
system (ftf)$ eT) , cf. Edgar [5] or Barnsley 0, has the fundamental domain F as an 
invariant set, i.e., 

U /4^) = * _1 ^u |J ($-H + $- w F) . 

That formula also reflects the fact that we have two possibilities building the ele- 
ments £ G NAF°'°° from left to right: We can either append 0, what corresponds 
to an application of <$> , or we can append a non-zero digit d G T>* and then add 
w — 1 zeros. 

Furthermore, the iterated function system (f-d)^ € x> mm l s Moran's open set con- 
ditio!^ cf. Edgar [9] or Barnsley [2]- The Moran open set used is int T . This set 
satisfies 

/tf(intJ-)nJV(int.F) = 

for i} ^ §' G V and 

int T 3 f$ (int JF) 

for all d G T>. We remark that the first condition follows directly from the tiling 
property in Corollary |7. 3 on the facing page| with K = — 1. The second condition 
follows from the fact that is an open mapping. 

Next we want to have a look at the Hausdorff dimension of the boundary of J- '. 
We will need the following characterisation of the boundary. 

Proposition 7.5 (Characterisation of the Boundary). Let z e f. Then z G dJ- 
if and only if there exists aw- NAF G NAF*"- 00 with £/ ^ such that 

z = value(£/.£ F )- 

Proof. The proof is a straight forward generalisation of the proof of the quadratic 
case in [TJ]. □ 

The following proposition deals with the Hausdorff dimension of the boundary 
of T. 

Proposition 7.6. For the Hausdorff dimension of the boundary of the fundamental 
domain we get dim# d J- < n. 

The idea of this proof is similar to a proof in Heuberger and Prodinger [T5] , and 
it is a generalisation of the one given in |12) . 



Proof. Set k := ko + w — 1 with fcp from Lemma 5.4 on page 9[ For jeN define 



U, := {£ G NAF^ : . . . £_0 +fc -i) ^ fc for alU G {1, . . . , j - k + 1}} . 

The elements of Uj, or more precisely the digits from index —1 to —j, can be 
described by the regular expression 




^"Moran's open set condition" is sometimes just called "open set condition" 
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FIGURE 7.1. Automaton A recognising UjeN Uj from right to left, 
sec proof of Proposition |7.6| The state S is the starting state, all 
states are valid end states. An edge marked with 7^ means one 
edge for each non-zero digit in the digit set T>. The state 7^ 
means that there was an non-zero digit read, a state e means that 
t zeros have been read. 



This can be translated to the generating function 

/ w-2 \ 

7 t+i ) 

used for counting the number of elements in Uj. Rewriting yields 



j6N \ e=o 




C(7\ = 1 ~ Zk 1 + ~ 1)2 Z * V ' ZW 
[ ' 1 - Z 1 - Z - #VZ W + #2?»Z fc + 1 ' 

and we set 

q(Z) :=1-Z- #VZ W + #VZ k+1 . 



Now we define 



Uj := {£ € : 0} 



and consider U ■= UjeN Uj- Suppose w > 2. The w-NAFs in that set, or more 
precisely the finite strings from index —1 to the smallest index of a non-zero digit, 
will be recognised by the automaton A which is shown in Figure |7.1| and reads 
its input from right to left. It is easy to see that the underlying directed graph 
G.4 of the automaton A is strongly connected, therefore its adjacency matrix M_4 
is irreducible. Since there are cycles of length w and w + 1 in the graph and 
gcd(w,w + l) = 1, the adjacency matrix is primitive. Thus, using the Perron- 
Frobenius theorem we obtain 

#Uj = # (walks in of length j from starting state S to some other state) 
= (1 ... 0)Mif:l =c(ap n y(l + 0{ S i)) 
for a c > 0, a a > 0, and an s with < s < 1. Since the number of iu-NAFs of 



length j is 0(p n: >), see Theorem 4.7 on page 6 



we get a < 1. 
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We clearly have 

Uj = l+J Ut, 

i=j-k+i 

so we get 

#Uj = [&] G{Z) =c(ap n Y (1 + O(si)) 

for some constant c > 0. 

To rule out a = 1, we insert the "zero" p~ n in q(Z). We obtain 

q(p~ n ) = 1 - p~ n - #Vp-' nw + #D*p" n(fc+1) 

= 1 - p- n - p"^" 1 ) (p n - 1) p- nw + p n ( w ~ l ) ( p n - l) 

= (p n - 1) p"(«- fc - 2 ) > 0, 

where we used the cardinality of T>* from our set-up in Section [3] and p > 1. 
Therefore we get a < 1. It is easy to check, that the result for #Uj holds in the 
case w = 1, too. 
Define 

C/ := {valued) : £ e NAF°"°° with . . . £_ ( / +fc _i) ^ fe for all * > 1} . 

We want to cover U with hypercubes. Let C C R™ be the closed paraxial hypercube 
with centre and width 2. Using Proposition |5.1 on page 6| yields 

UC (J (z + B up - j C) 

s(Evalue(C/j ) 

for all j € N, i.e., U can be covered with #Uj boxes of size 2Bup~K Thus we get 
for the upper box dimension, cf. Edgar [5], 

<BE B U< lim , l0 f # ^ . v 

Inserting the cardinality ~$Uj from above, using the logarithm to base p and < 
s < 1 yields 

log pC + jlog p (ap")+log p (l + 0(^")) 
dim B U < hm — = = n + log„ a. 

j-yoo j + U(l) 

Since a < 1, we get dim^f/ < 2. 

Now we will show that C J7. Clearly U C J, so the previous inclusion is 
equivalent to T \ U C int(J r ). So let z e J 7 \ 17. Then there is a £ e NAF°-°° such 
that z = value(£) and £ has a block of at least k zeros somewhere on the right hand 
side of the $-point. Let £ denote the starting index of this block, i.e., 

€ = 0. £-i . . . £-(£-i) k £-(e+k)£,-(e+k+i) — 

Let = 0j.0A#-<ei?-(*+i) • • • e NAF^ n -°° with value(tf) = z. We have 
z = value(0.£ A ) + ^~ e ~ w z 6 = value(i?/.t? A ) + r'^z^ 



for appropriate z^ and z#. By Lemma 5.4 on page 9 all expansions of z^ are in 
NAF°-°°. Thus all expansions of 

valueO?/!^) + $~ ( "'~ l) z 1? - valued) = ¥^ z - value(£ A ) = $- (lu - 1) z ? 

start with 0.0™ -1 , since our choice of k is fco + w — 1. As the unique ui-NAF of 
value(i9/i? J 4) — value^^) concatenated with any w-NAF of <J> _ (™ _1 ),2:,j gives rise to 
such an expansion, we conclude that value^/tf^) — valuef^) = and therefore 
= and i?^ = So we conclude that all representations of z as a w-NAF have 
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to be of the form O.^aO^' 1 r] for some w-NAF r\. Thus, by using Proposition 7.5 



on page 11 we get z £ dT and therefore z € int(J r ). 



Until now we have proved 

dimsdJ- < AyciibU < n. 

Because the Hausdorff dimension of a set is at most its upper box dimension, cf. 
Edgar 9\ again, the desired result follows. □ 

8. Cell Rounding Operations 

In this section we define operators working on subsets of the space R". These 
will use the lattice A and the tiling T. They will be a very useful concept to prove 
Theorem |10.1 on page 17| 

Definition 8.1 (Cell Rounding Operations). Let B C R™ and j e %. We define 
the cell -packing of B ("floor £?") 

[B\ T := |J T z and B : <1> '('1' '/>',). 

z£A 
T Z CB 

the cell covering of B ("ceil B") 



\B] T := [BCfr and \B] Tj := $-J(\&B] T ) , 

the fractional cells of B 

{B} T :=B\[B\ T and {B} Tj := B} T ) , 

the cell covering of the boundary of B 



d{B) T := \B~\ T \ [B\ T and d{B) TJ := (d(& B) T ) , 

the cell covering of the lattice points inside B 

[B] T := |J T z and [B] TJ := B] T ) , 

26BnA 

and the number of lattice points inside B as 

#{B) T := #(£? n A) and #(B) TJ := #(^S) T . 

For the cell covering of a set B an alternative, perhaps more intuitive description 
can be given by 

\B] T := |J T z . 

The following proposition deals with some basic properties that will be helpful 
when working with those operators. 

Proposition 8.2 (Basic Properties of Cell Rounding Operations). Let B C R" 
and j € TL. 

(a) We have the inclusions 

[B\ TJ QBCBC \B] T>j 

and 

[B\ TJ C [B] TJ C \B] T<j . 

For B' C E™ with B <Z B' we get \B\ Tj C LB'Jt.j, |#1t.j £ L^'It.j and 
[_B] Tj - C |\B'] Tj ., i.e., monotonicity with respect to inclusion. 
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(b) The inclusion 

{/>'! , ., c d(B) T j 

holds. 

(c) We have dB C d{B) T] and for each cell V in d(B) T j we have T' n dB ^ 0. 
('dj For B' C R™ tuii/i £?' disjoint from B, we get 

#(BUB') Tj =#(5) rij +#(S')T,i. 
and therefore the number of lattice points operation is monotonic with respect 
to inclusion, i.e., for B" C E" iwi/i B" C B we have #(B") Tj < #(B) TJ . 
Further we get 



#(B) T ,, =# [IB] T A =\det$ 



A 



Proof. The proof is a straight forward generalisation of the proof for Voronoi-tilings 
in the quadratic case in [TJ]. □ 

We will need some more properties concerning cardinality. We want to know the 
number of points inside a region after using one of the operators. Especially we 
are interested in the asymptotic behaviour, i.e., if our region becomes scaled very 
large. The following proposition provides information about that. 

Proposition 8.3. Let U C R™ bounded, measurable, and such that 

#(9(*[/) T ) T = o(|det*| 5/ ") 

for |det >J/| — ► oo with maps 'J : R n — > R™ and a fixed S £ R with S > 0. 

(a) Wegetthateachof#(l^U\ T ) T , #(|"W] T ) T , #(|_W] T ) T and#(W) T equals 

\ det y\^} + o(\dety\ 5/n 
d\ V 

In particular, let N £ R, N > 0, and set ^ — diag(-/V, . . . , N), which we identify 
with N. Then we get that each one of#{[NU\ T ) T , #(\NU] T ) T , #([NU] T ) T 
and #(NU) T equals 

N nHEl +0 (N S ). 

d A 

(b) Let N £ R, N > 0, and set * = diag(7V, . . . ,N), which we identify with N. 
Then we get 

#((N + 1)U\NU) T = 0(N 5 ). 

Proof. Again, the proof is a straight forward generalisation of the proof for Voronoi- 
tilings in the quadratic case in [12) . □ 

Note that S = n — 1 if the U is, for example, a ball or a polyhedra. 

9. The Characteristic Sets 

In this section we define characteristic sets for a digit at a specified position in 
the w-NAF expansion and prove some basic properties of them. Those will be used 
in the proof of Theorem |10.1| 

Definition 9.1 (Characteristic Sets). Let rj £ T>* . For j £ No define 

W„j := {valued) : $ £ NAF° w j+w with - n} . 

We call l/Wr/.jlTj+u; the jth approximation of the characteristic set for rj, and we 
define 
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Figure 9.1. Fundamental domains and characteristic sets W v - 
Each figure shows a fundamental domain. The light-gray coloured 
parts represent the approximations W n j of the characteristic 
sets WV 



Further we define the characteristic set for rj 

W„ := {valued) : £ G NAF°-°° with £-„ = r,} 

and 

W v := {W„} A • 

For j G N we set 

/9 M -:=A(LW nJ l TiJ . + J-A(W,)- 

Note that sometimes the set will also be called characteristic set for r], and 
analogously for the set W v j. In Figure 9.1 some of these characteristic sets, more 
precisely some approximations of the characteristic sets, are shown. 

The following proposition deals with some properties of those defined sets. 

Proposition 9.2 (Properties of the Characteristic Sets). Let rj 6 D*. 

(a) We have 

Wr, = t)T~ W + <S>-' 2W + 1 F. 

(b ) The set W n is compact. 

(c) We get 



W v = II W v j = lim W v ,j. 

^-^ 7—^-00 

ieNo 

(d) The set [W^j] t j+w * s indeed an approximation ofW n , i.e., we have 

Wr, = liminf [W v ,j] Ttj+w = lim sup [W v ,j] T j+w . 

(e) We have int)% C liminfj £No lWr,,j] T j +w - 

(f) We get W„ - ^ w i] C T, and /or j G N we ofriam |VV„,j] T j+w - $~™?7 C T. 

(g) For the Lebesgue measure of the characteristic set we obtain A(W I; ) = X(W n ) 
and for its approximation ^([yVjjjIj, j +w J = A(W^j). 
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(h) Let j 6 No, then 

^(Lw^l T , i+ro )=^ + o(M J ) 

with E and fi < 1 from Theorem \4.7 on page 6\ 

(i) The Lebesgue measure ofW v is 

A(W„) = d A E, 

again with E from Theorem \4-7 on page 6\ 
(j) Let j € N . We get 

Pvd = [ - lw v )(x)6x = 0(ft>) . 

Jx£T 

Again fi < 1 can be found in Theorem \4- 7 on page 6[ 

Proof. The proof is a straight forward generalisation of the proof in |12j . □ 

We can also determine the Lebesgue measure of the fundamental domain T 
defined in Section [3 

Remark 9.3 (Lebesgue Measure of the Fundamental Domain). We get 

K f )= n(2 W -l )EdA= P 

{p n — l)W + 1 



using Q a nd ^ from Proposition 9.2 on the facing page and E from Theorem 4.7 
|on pageB] 

The next lemma makes the connection between the w-NAFs of elements of the 
lattice A and the characteristic sets W v j. 

Lemma 9.4. Let rj € V, j > 0. Let z € A and let £ e NAF^ 1 - be its w-NAF. 
Then the following statements are equivalent: 

(1) The jth digit of £ equals r\. 

(2) The condition {^^ +w ^z} A E W V:J holds. 

(3) The inclusion {^ u+w) T z } A C W nJ holds. 

Proof. The proof is a straight forward generalisation of the proof of the quadratic 
case in [12]. □ 

10. Counting the Occurrences of a non-zero Digit in a Region 

In this section we will prove our main result on the asymptototic number of 
occurrences of a digit in a given region. 

Note that Iverson's notation [eipr] = 1 if expr is true and [eayr] = otherwise, 
cf. Graham, Knuth and Patashnik [11], will be used. 

Theorem 10.1 (Counting Theorem). Let ^ r\ e V and N e R with N > 0. 
Further let U C R™ be measurable with respect to the Lebesgue measure and bounded 
with U C B(0,d) for a finite d, and set S such that #(d(NU) T ) T = 0(N 6 ) with 
1 < S < ri. We denote the number of occurrences of the digit r] in all integer 
width-w non-adjacent forms with value in the region NU by 

Z V (N) = [jth digit of z in its w-NAF -expansion equals if\ . 

z£NUnA jeM 

Then we get 

Z V (N) = N n X(U) E log p N + N n ^ (log, N) + 0(N a log p N) + 0(N 6 log p N) , 
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in which the expressions described below are used. The Lebesgue measure on R™ is 
denoted by A. We have the constant of the expectation 

E = 



cf. Theorem 4-7 on page 6[ Then there is the function 

ip v (x) = ip n ,M{x) + i> v ,v{x) + ip v ,Q(x) , 

where 

^ v ,m(x) = X(U)(J + 1-{x})E, 
E / (l w ({&- w y} A )-\(W))dy, 

and 

3=0 

1 



4 

We have a = n + log p p, < n, with [i = [\ + —^js J < 1> and 

J = [logpd-log^ij+l 

wii/i i/ie constant Bl of Proposition ^). 2 on page <S| 
Further, let 

$ = Qdmg(pe ie \...,pe^)Q-\ 

where Q is a regular matrix. If there is a p € N such that 

Qdiag(e i9lP ,...,e ie " p ) Q~ l U = U, 

then iprf is p-periodic. Moreover, if i^^ is p-periodic for some p£N, then it is also 
continuous. 

Remark 10.2. Consider the main term of our result. When N tends to infinity, we 
get the asymptotic formula 

Z v ~ N n X(U) Elog p N. 

This result is not surprising, since intuitively the number of lattice points in the 
region NU corresponds to the Lebesgue measure N n X(U) of this region, and each 
of that elements can be represented as an integer w-NAF with length about log p N. 
Therefore, using the expectation of Theorem 4.7 on page 6[ we get an explanation 
for this term. 

Remark 10.3. If S = n in the theorem, then the statement stays true, but degener- 
ates to 

Z n (N) = C)(N n log lTl At). 
This is a trivial result of Remark 110.21 



The proof of Theorem 10.1 on the preceding page follows the ideas used by 
Delange [6]. By Remark 10.3 we restrict ourselves to the case 5 < n. 

We will use the following abbreviations. We omit the index 77, i.e., we set Z(N) : 
Z n (N), W := W v and Wj := W v ,j, and further we set /3j :— (3, h j, cf. Proposition 



9.2 



on page 16 By log we will denote the logarithm to the base p, i.e., logo; = log p x. 
1'hese abbreviations will be used throughout the remaining section. 
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Proof of Theorem 10.1 By assumption every element of A is represented by a 
unique element of NAF*"'°. To count the occurrences of the digit 77 in NU, we 
sum up 1 over all lattice points z £ NU H A and for each z over all digits in the 
corresponding iu-NAF equal to 77. Thus we get 

Z(N)= ^2 E ^ th digit of W " NAF of z equals 77] . 

zeNUnA jeNo 

The inner sum over j £ Nq is finite, we will choose a large enough upper bound J 



later in Lemma 10.4 on the next page 
Using 

[jth digit of w-NAF of z equals 77] = \ Wj ({®~ j ~ w z} A ) 
from Lemma [9.4 on page 17| yields 

*w = E E ! ^({ ri "MA). 

j=0 zGNUnA 

where additionally the order of summation was changed. This enables us to rewrite 
the sum over z as an integral 

W = E E xfr)f ('!•" ' "•'•IaH-'- 



We split up the integrals into the ones over NU and others over the remaining 
region and get 



Z ( N ) = Y(T) E / ^ ({^Ma) d * + 



in which F V (N) contains all integrals (with appropriate signs) over regions [NU] T \ 
NU and NU\ [NU] T . 

By substituting x = $ J y, dx = |det $| J dy = p nJ dy we obtain 

Reversing the order of summation yields 

z w = ^E / ^.({^-MJ^+^w- 

^ J ,=0 Jve<i>- J NU 



We rewrite this as 

„n J 



Z(N) = {-r(J+l)\(W) I dy 



p 





rJlJ J 



vrn E/ (iHr^-yy-ACwo)^ 



V ™E/ (i Wj _ 3 ({<f^} A )- 1 ^({ <i) ^}A)) d y 

A l J J .-_ n Jv£<S>~ J NU 



J=Q Jy£<S>- J NU 
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With $- J NU = [$- J NU\ T w U {§~ J NU} T:j _ w for each area of integration we 
get 

Z(N) = M V (N) + Z V {N) + V V {N) + Q n (N) + S n (N) + F V (N) , 



in which M. n is "The Main Part", see Lemma 10.6 on the next page 

M v (N) = ^-(J+l)\(W) [ dy, 

Z v is "The Zero Part", see Lemma 10.7 on the facing pagc[ 
p J 



(10.1a) 



A(T) 



(l w ({&- w y} )-X(W))dy, (10.1b) 



V v is "The Periodic Part", see Lemma 10.8 on page 22 

„nj J 



E 



A(T) 



(l w ({V- w y} A )-\{W))dy, (10.1c) 



Q v is "The Other Part", see Lemma 10.9 on page 23| 



E 



-0 Jy£V<S>- J NU\r^ 



{l Wj _ j -t w ){{^- w y} A )Ay, (lO.ld) 



S v is "The Small Part", see Lemma 10.10 on page 24 



S n (N) 



E 



=0 Jy£{i>- J NU} T 3 _ 



(1 



Wj- 



lw)({&- w y} A )dy (lO.le) 



and ^ is "The Fractional Cells Part", see Lemma 10.11 on page 25 
^(N) = t4v E / Iwi ({S-'-'MJ dx 



(10. If) 



— y 



l Wj ({$-i- w x} A ) Ax. 



\{T) 

To complete the proof we have to deal with the choice of J, see Lemma |10.4| as 



well as with each of the parts in ( 10.1 ), see Lemmata 10.6 to 10.11 
The continuity of ip„ is checked in Lemma 10.12 on page 26 



on pages 



21 



25 



□ 



Lemma 10.4 (Choosing J). Let N € R> . Then every w-NAF o/NAF" with 
value in NU has at most J + 1 digits, where 

J= LlogiVj+ Jo 

with 

Jo = Llogd-logB L J +1 
with Bl of Proposition \5.2 on page 8[ 

Proof. Let z e NU, z^0, with its corresponding w-NAF £ e NAF^ n '°, and let 
j £ No be the largest index such that the digit £j is non-zero. By using Corollary 5.3 
|on page "8"! we conclude that 

(PB L < \\z\\ < Nd. 

This means 

j < log N + log d- log B L , 

and thus we have 

j < [log N + log d — log B L \ < [log AJ + [log d - log B L \+l. 
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Defining the right hand side of this inequality as J finishes the proof. □ 

Remark 10.5. For the parameter used in the region of integration in the proof of 
Theorem |10.1 on page 17| we get 

|det ($~ J iV)| = 0(1) . 

In particular, we get ||$~' 7 A|| = 0(1). 

Proof. We have 

|det ($- J iV)| = {p- J N) n . 
With J of Lemma 10.4 on the facing page we obtain 

p -J N = p -\_\ogN\-J Ao & N = ^logJV-UogiVJ-Jo = p {\o S N}-J _ 

Since p {^eN}-J is bounded by p 1 "- 7 ", it is 0(1). Therefore det ($~ J 7V) is 0(1). 



Since ||$ _1 |l = p 1 we conclude that ||<I> J 7V|| is 0(1). 



□ 



Lemma 10.6 (The Main Part). For (10.1a) in the proof of Theorem 10.1 on 
\page 17\ we get 

M V {N) = N" X(U) £ log A + N n (log A) 
with a l-periodic function ip v ,M> 

4> vM {x) = \{U){J + l-{x})E 
and E of Theorem \4-7 on page 6[ 
Proof. We have 



M V (N) 



P 



71 J 



A(T) 



(J + 1)X{W) 



y£<f>- J NU 



dy. 



As \(<f>- J NU) = p~ nJ N n \(U) we obtain 



Mr,(N) = ^±(J + l)N n \(U) 



By taking \{W) = A(T) E from ^ of Proposition 9.2 on page 16 and J from 
Lemma |l0.4 on the facing page| we get 

Mr,(N) = N n X(U)E ([log N\ + J + l). 

Finally, the desired result follows by using [x\ = x — {x}. □ 



Lemma 10.7 (The Zero Part). For ( 10.1b ) in the proof of Theorem 10.1 on page 17 
we get 

Z v {N) = 0. 

Proof. Consider the integral 



(l w ({&- w y} A )-\(W))dy. 



lye[^- J NU\ Ti . 

We can rewrite the region of integration as 

[$- J NU\ T ._ w = [&- w $- J NU\ T = $-Cj'-"0 (J T z 



for some appropriate Rj- W C A. Substituting x = $ J w y, dx = p 



n(j-w) 



dy yields 



T. — n -n(j-w) 
i.j — p 



(l w ({x} A )-X(W))dx. 
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We split up the integral and eliminate the fractional part {x} A by translation to 
get 



V f (t w (x)-X(W))dx. 



=o 



Thus, for all j £ N we obtain Ij = 0, and therefore Z„(N) = 0. 



□ 



(10.2) 



Lemma 10.8 (The Periodic Part). For (10.1c I in the proof of Theorem 10.1 on 
\page 17\ we get 

V V {N) = N n i> v , v {\ogN) + 0(N S ) 

with a function ipri,V> 

M*) = 9 \(rp\ E / r , (l w ({&- w y} A )-\(W))dy. 

Let 

<P = Qdmg(pe l9 \...,pe w ")Q-\ 
where Q is a regular matrix. If there is a p £N such that 
Qdiag(e ieiP ,...,e ie " p ) Q^U = U, 

then ipri,v is p-periodic. 
Proof. Consider 

l r .= f {lw{{&- w y} A )-X(W))dy. 

Jye{$- J NU} T:j _ m 

The region of integration satisfies 

{*- J NU} T> ._ w Cd(l>- J NU) T> ._ w = Z-V-^ |J T z 

for some appropriate Rj- W C A. 

We use the triangle inequality and substitute x = &~ w y, dx — p n ^^ w > dy in 
the integral to get 



(10.3) 



\I s \<p-»V-«) f | 



lw({x} A )~X(W)\dx. 



<1+\(W) 

After splitting up the integral and using translation to eliminate the fractional part, 
we get 

|/.|<p-»O--»)(l + A(W0) £ / dx = p-^- w Hl + X(W))X(T)#(R j . w ). 



Using #(d(W) T ) T = o(|det*| 5/n ) as assumed and ( fT03| ) we gah 
#(Rj- w ) = |det ($- J N&- w )\ S/n = ofpU-")*) , 



because |det ($~ J iV)| = O(l), see Remark 10.5 on the previous page 
p n . Thus 



and |det$| 



\ij\ = o(p s v- w )- n( j- w ^ = o(p (S - n)j ^ . 

Now we want to make the summation in V v independent from J, so we consider 



„n J 



E h 



X(T) ^ 
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Again we use triangle inequality and we calculate the sum to obtain 



\i\ = o( P nJ ) 0(p (5_n)i ) =0U>"V 5 " n)J ) =o( P 5J ) 

j=J+i 

Note that 0(p J ) = 0(N), so we obtain |/| = 0(N S ). 
Let us look at the growth of 

n I J 



V ' 3=0 



We get 



\P n (N)\ = 0( P nJ ) = 0(p nJ ) = 0{N n ) , 

using (5 < n. 

Finally, inserting J from Lemma |10.4| and extending the sum to infinity, as 
described above, yields 



E 



=0 Jye{f>- J NU} T 3 _ 

= N n ^ v (log N) + 0(N s ) 

with the desired ip v j>. 

Now suppose ( 10.2 ) holds. Then 



(1 W ({<F->} A )-A(W0) dy 



+ Jo) , . . . p-W-Jog-iMlAl+.A)) 



^-Lxj-Jopx^ = ^Qdiag^-W-Jbe-Wid*] 

= p^- Ja Qdi&g(e- l0 ^ +Jo \ c -««(L*J+JoA q-x 

Now, we can conclude that the region of integration in ^ p(x) is p-periodic us- 
ing ( 10.2 1. All other occurrences of x in ip rit -p(x) are of the form {a;}, i.e., 1-periodic, 
so period p is obtained. □ 



Lemma 10.9 (The Other Part). For (10. Id) in the proof of Theorem 10.1 on 
\page 17\ we get 

Qn(N) = A"^,q + 0(N a log A) + 0(N S ) , 

with 

X(U)^ ft 



E 



A(T) £j A(T) 



and a — n + log p < n, where p < 1 can &e found in Theorem \4- 7 on page 6[ 
Proof. Consider 

/ (l^-lw)({^-^} A )dy. 

We can rewrite the region of integration and get 

[$- J NU\ T ._ w = fc-CJ-") [&- w $- J NU\ T = *-k'-«0 |J T 2 



for some appropriate Rj- W C A, as in the proof of Lemma 10.7 on page 21 Sub- 
stituting a; = &~ w y, dx — p n< J~ w > dy yields 



Ij,t = P 



-n(j-iu) 



( 1 w,, 4 - liv)({£} A ) da; 
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and further 



,e = P 



-n(j-w) 



by splitting up the integral, using translation to eliminate the fractional part and 



taking according to of Proposition 9.2 on page 16 From Proposition 8.3 on 
|page 15| we obtain 

#(Rj- w ) |det($- J 7V$J- 10 )| X(U) (\det($- J N&- u ')\ S/n \ 



pn(j-w) pn(j-w) A(T) 

which can be rewritten as 

p- nJ N 



O 



pn(j-w) 



#{R^ W ) _ „_ njArn A(t7) 
A(T) 



P 



n(j-w) 



o 



because |det$| = p n and because |t j N\ — 0(1), see Remark 10.5 on page 21 
Now let us have a look at 

nj J 
V ' 3=0 



Inserting the result above and using Pi — £)(//), see (jjj) of Proposition 
|page 16| yields 

X(U) 



9.2 on 



Q ^ N) = r ?SS + p,lJ E°(^ M3 ') °b 

W)) J= o j=0 
Therefore, after reversing the order of the first summation, we obtain 

l A l J )) f=0 



3=0 



If /ip™ 5 > 1, then the second sum is JO(l), otherwise the sum is 0[p J p( s 2 ' J ). 
So we obtain 

Q ^ N) = r SE ^ + 0( P nJ p J J) + o( P SJ ) . 

l A U ) ) ,=o 



Using J = O(logiV), see Lemma 10.4 on page 20 and defining a = n + logp yields 
Q n (N) = N n /x A ^ 2 & + ° ( NH+l ° S * log N)+0(N 5 ). 



=0(N a log AT) 



(AW 



Now consider the first sum. Since f3j = O^), see (|jj) of Proposition 
|page 16) we obtain 

oo 

N n (3j = N n 0(p J ) =0(N a ). 
j=j+i 

Thus the lemma is proved, because we can extend the sum to infinity. 



9.2 on 



□ 



Lemma 10.10 (The Small Part). For (10. lei in the proof of Theorem 10.1 on 
\page 17\ we get 

S V (N) = 0{N a log TV) + 0(N 5 ) 
with a = n + \ogp < n and p < 1 from Theorem ^. 7 on page 6 
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Proof. Consider 



(t Wt -l w )({&- w y} A ) dy. 

lye{'S>- J NU} T d _ w 

Again, as in the proof of Lemma [l0.8 on page 22| the region of integration satisfies 



{$- J NU} TJ _ w Qd($- J NU) TJ _ w = $-(i-^ |J T. 

for some appropriate Rj- W C A. 

We substitute x = &~ w y, dx — p n ti~ w "> dy in the integral to get 



(10.4) 



\h 



e\=P 



-n{j-w) 



(t We - l w )({x} A ) dx 



Again, after splitting up the integral, using translation to eliminate the fractional 
part and the triangle inequality, we get 



\ht\<P~ n{j ~ w) E I {^w t -lw){x)dx 



=\M 



in which |/3^| = 0(//) is known from |j| of Propositio n 9.2 on page 16 Using 
#{d(W) T ) T = o(|det*| 5/ "), Remark 10.5 on page 21 



and ( 10.4 1 we get 



#(Rj- w ) = 0( Idet $~ J A$ J ' 



,<5/n 



because |det$| = p n and |t~ j A| = 0(1). Thus 

\i jti \ = = o(MV tf_n)i ) 



follows by assembling all together. 
Now we are ready to analyse 

S V (N) 

Inserting the result above yields 



E 1 



A(T) 

K ' 1=0 



\S V (N)\ 



A(T) 



J nj J 



<pp 



i—6\ J 



J=0 v ' i=0 

and thus, by the same argument as in the proof of Lemma |10.9 on page 23[ 

\Sr,(N)\ = /i J p nJ o(j + /^ J P ( ^ n)J ) - 0(p J p nJ J) +0( P 5J ) . 
Finally, by using Lemma [10.4 on page 20| we obtain 

\S V (N)\ = (D(N a log N)+(D(N S ) 
with a = n + log p. Since fi < 1, we have a < n. 



a 



Lemma 10.11 (The Fractional Cells Part). For (10. If) in the proof of Theo- 
rem \10.1 on page Il\ we get 



F^N) = (A 5 log A) 
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Proof. For the regions of integration in J 7 ^ we obtain 

NU \ [NU] j, C \NU] j, \ [NU\ j, = d{NU) T = |J T z 



zeB. 



and 

[NU] T \ NU C \NU] T \ INU\ T = d(NU) T = [j T z 

zeR 

for some appropriate R C A using Proposition |8. 2 on page 14] Thus we get 

in which the indicator function was replaced by 1. Dealing with the sums and the 
integral, which is 0(1), we obtain 

\F n {N)\ = (J + l)#iJO(l). 



Since J = O (log TV), see Lemma 10.4 on page 20 and #R = 0(N d ), the desired 
result follows. □ 



Lemma 10.12. If the ip^ from Theorem 10.1 on page 11 is p-periodic for some 
p£N, then ip„ is also continuous. 

Proof. There are two possible parts of ipr] where an discontinuity could occur: the 
first is {x} for aniGS, the second is building {. . -} T j_ w in the region of integration 
in ip VtV . 

The latter is no problem, i.e., no discontinuity, since 



/ r i (l w ({&- w y} A )-\(W))dy 



(l w ({&- w y} A )-\(W))dy, 



because the integral over the region [$~ ^~ J ° p x U\ T ._ w is zero, see proof of 
Lemma |10.7 on page 21| 

Now we deal with the continuity at x £ 7L. Let m £ x + p/Z, let M — p m , and 
consider 

Z V (M) - Z V (M - I) . 
For an appropriate a £ R we get 

Z V (M) = aM n log M + M n ^(log M) + 0(M a log M) + 0(M S log M) , 
and thus 

Z V (M) = aM n m + M n ip n (m) + 0(M a m) + 0(M s m) . 

Further we obtain 

Z V (M -l) = a(M- l) n log(Af - 1) + (Af - 1)™ ijj v (log(M - 1)) 

+ 0((M - 1) Q log(M - 1)) + o((M - l) 5 log(M - 1)) , 

and thus, using the abbreviation L = log(l — M" 1 ) and 8 > 1, 

Z n (M - 1) = aM n m + M n i(j n (m + L) + 0(M a m) + 0(M 5 m) . 
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Therefore we obtain 

Z v (M)-Z,(M-l) = ^ {x) +L) + o(MQ -„ m) +Q ( M 8-n m) 

Since #(M£/ \ (M — 1) U) T is clearly an upper bound for the number of w-NAFs 
with values in MU \ (M — 1) U and each of these w-NAFs has at most [log MJ + 
Jo + 1 digits, see Lemma [l0.4 on page 20[ we obtain 

Z n (M) - Z V (M - 1) < #(MU \ (M - 1) U) T (to + J + 2) . 

Using |b]) of Proposition 8.3 on page 15 yields 

Z V (M) - Z V (M - 1) = 0(M s m) . 

Therefore we get 



i/jr,(x) - ip v (x + L) = 0(M s - n m) + 0(M q "™to) + 0(M s - r 'm) 
Taking the limit to — > oo in steps of p, and using a < n and S < n yields 

ipT]{x) — lim Tp v (x + e) = 0, 
i.e., is continuous at x G 7L. □ 

11. Counting Digits in Conjunction with Hyperelliptic Curve 

Cryptography 

As mentioned in the introduction, we are interested in numeral systems coming 
from hyperelliptic curve cryptography. There the base is an algebraic integer, where 
all conjugates have the same absolute value. 

Let H be a hyperelliptic curve (or more generally an algebraic curve) of genus g 
defined over ¥ q (a field with q elements). The Frobenius endomorphism operates 
on the Jacobian variety of H and satisfies a characteristic polynomial / € 7L\T\ of 
degree 2g. This polynomial fulfils the equation 

/(T)=T 2 9L(1/J), 

where L(T) denotes the numerator of the zeta- function of H over ¥ q , cf. Weil [THl 
f2T] . The Riemann Hypothesis of the Weil Conjectures, cf. Weil 20J, Dwork [5] and 
Deligne [7] , states that all zeros of L have absolute value 1 / y/q. Therefore all roots 
of / have absolute value ^fq. 

Later we suppose that r is a root of /, and we consider numeral systems with 
a base r. But before, we describe getting from that setting to a lattice, which we 
need in Section [3] This is generally known and was also used in Heuberger and 
Krenn [H] , 

First consider a number field K of degree n. Denote the real embeddings of K 
by (7i, . . . , a s and the non-real complex embeddings of K by ct s +i, <j s +i, ■ ■ ■ , 
<7 s+t , where v denotes complex conjugation and n = s + 2t. The Minkowski map 
E : K ->• E" maps a G K to 

(i7i (a), . . . ,cr s (a), 3?(7 s+ i (a), 3ct s+ i (a),. . . , 3?(7 s+i (a), 9?<7 s+t (a)) G JR". 

Now let r be an algebraic integer of degree n (as above, where r was supposed to be 
a root of the characteristic polynomial / of the Frobenius endomorphism) and such 
that all its conjugates have the same absolute value p > 1. Note that the absolute 
value of the field norm of r equals p n . Set K — Q(r) and consider the order 7L\t\. 
We get a lattice A = S(K[r]) of degree n in the space E". Application of the map 
$ : A — > A on a lattice element should correspond to the multiplication by r in the 
order, so we define $ as block diagonal matrix by 



$ :=diag (7i(r), . . . , <7 s (t), 



5Rct s + i(t) -Qo- s+ i(t)\ /5Rcr s+t (r) -3<T s+t (-r) 

S CTs + l(r) & s+ i(t) l'--''b ffs+t (r) K<T s+t (r) 
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The eigenvalues of $ are exactly the conjugates of r, therefore all eigenvalues have 
absolute value p. For the norm || • |j we choose the Euclidean norm || • || 2 . Then the 
corresponding operator norm fulfils 

||$|| =max{| ( r i (r)| : j G {1, 2, . . . , s + 1}} = p. 

In the same way we get ||3> _1 || = p~ x ■ 

Now let T C R™ be a set which tiles the R n by the lattice A, choose w as 
in the set-up in Section [3j and let T> be a reduced residue digit set modulo $> w 
corresponding to the tiling, cf. also Heuberger and Krenn [TJ]. Since our lattice A 
comes from the order S[r] and our map $ corresponds to the multiplication by r 
map, the size of the digit set V is p n ^ w ~ 1 '> [p n — 1) + 1, see [H] for details. 

Since our set-up, see Section[3j is now complete, we get that Theorem 1 10 . 1 1 holds . 
We want to restate this for our special case of r-adic w-NAF-expansions. This is 



done in Corollary 11.2 To prove periodicity of the function ipjj in that corollary, 
we need the following lemma. 

Lemma 11.1. Suppose 

<f> = Qdv A g(pe l9 \...,pe^)Q-\ 

where Q is a regular matrix and let U = B(0, 1) be the unit ball. Then 

Qdiag(e lf \...,e ie ") QT X V = U. 

Proof. Since $ is normal, the matrix Qdiag(e iei , . . . ,e l6n ) Q^ 1 is unitary. There- 
fore balls are mapped to balls bijectively, which was to prove. □ 

Now, as mentioned above, we reformulate Theorem |10.1| for our r-adic set-up. 
This gives the following corollary. 

Corollary 11.2. Let r be an algebraic integer, where all conjugates have the same 
absolute value, denote the embeddings o/(Q(r) by o~\, . . . , o- s+t o,s above, and define 
a norm by \\z\\ = X)i=i \ a i( z )\ with dx = ■■ ■ = d s = 1 and d s+ i = ■ ■ ■ = d s+t — 
2. " 

Let 7^ rj G T> and JVgE with N > 0. We denote the number of occurrences of 
the digit r\ in all width-w non-adjacent forms in 2[r], where the norm of its value 
is smaller than N , by 

Z rt (N) = y y [jth digit of z in its w-NAF- expansion equals rj] . 



\\z\\<N 



Then we get 



W 2 

Z V (N) = N n ———E log p N + N n ^ (log, N) + O (N? log p N) 



r(f + i) 

where we have the constant of the expectation 

E= 1 



pn(™-l)((pn - l) w + 1) : 



cf. Theorem 4-7 on page 6 a function i) v {x) which is 1-periodic and continuous and 
P <n. 

Proof. We choose U — B(0, 1) the unit ball in the R™. Then U is measurable, 
d = 1 and 8 = n — 1 < n. Further the n-dimensional Lebesgue measure of U equals 
Jl y The condition #(d(NU) T ) T = 0(N S ) can be checked easily. In the case 

of a quadratic r this is done in |12j . The periodicity (and therefore continuity) of 
rptj follows from Lemma [ll.l| We can choose (3 = max {a, n — 1}. □ 
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